The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from git diffs, commit messages, and external specification files. A malicious actor could craft a Pull Request containing hidden instructions designed to influence the agent's review or bypass its analysis axis.
Ingestion points: Git diff output, commit messages, and repository documents (e.g., docs/, specs/, .scratch/).
Boundary markers: The skill employs parallel sub-agents with specific briefs to isolate different review axes, and the instructions explicitly command the agent to treat author-supplied claims as "untrusted input".
Capability inventory: The skill utilizes shell commands for repository inspection (git diff, git log, git rev-parse) and includes the capability to "run focused tests or construct a minimal reproduction".
Sanitization: No explicit sanitization or filtering of the ingested git data is described before it is passed to the sub-agent prompts.
[DYNAMIC_EXECUTION]: The skill instructs the agent to "run focused tests or construct a minimal reproduction" when static analysis is insufficient to verify code correctness. This capability involves executing logic derived from or influenced by the untrusted diff, which could lead to the execution of malicious code embedded within the PR under review.
[COMMAND_EXECUTION]: The agent uses shell-based git commands to fetch data for review. These commands use parameters (like branch names or commit SHAs) provided by the user, which presents a surface for potential command injection if the underlying agent platform does not properly sanitize these values before shell execution.

code-review